A recruiting user can see Candidate Profile fields which he has not been given read permissions for.
Add a field to the Candidate Profile Template.
Do not give READ or WRITE for the field to any users/dynamic groups.
View the candidate profile and notice that the field can still be seen.
This is expected behaviour. You cannot "hide" any fields from the recruiting users - users who have access to Candidate Profiles will have a visibility of all fields.
To hide the fields from certain users/groups, you should define the fields on the Application Template rather than the Candidate Profile.
Once the fields are defined on the Application Template you will have full control over the permissions. For information on how to do this please see KBA 2343932.